Edit tour

Windows Analysis Report
https://mybell.bell.ca/Login?language=en

Overview

General Information

Sample URL:	https://mybell.bell.ca/Login?language=en
Analysis ID:	1546108
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64

chrome.exe (PID: 7068 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3100 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2264,i,8939700929347395739,7703461295604259672,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6864 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4184 --field-trial-handle=2264,i,8939700929347395739,7703461295604259672,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4980 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4608 --field-trial-handle=2264,i,8939700929347395739,7703461295604259672,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

conhost.exe (PID: 6936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 1424 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://mybell.bell.ca/Login?language=en" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 616 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://m.bell.ca/getapploginpage MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2240 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1656 --field-trial-handle=1064,i,6441221849923588881,12403408043935428112,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6196 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://m.bell.ca/supportrqcode MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2320 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1616 --field-trial-handle=2012,i,16209123222516514220,5828609412293976285,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Suricata Signatures

ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T14:12:20.787841+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.9	50026	87.248.119.252	443	TCP
2024-10-31T14:12:23.152546+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.9	50057	87.248.119.251	443	TCP
2024-10-31T14:12:47.422706+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.9	50346	142.250.185.174	443	TCP
2024-10-31T14:13:10.734140+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.9	50651	104.244.42.3	443	TCP
2024-10-31T14:13:10.763044+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.9	50652	172.66.0.227	443	TCP

HTTP traffic detected: POST /rb_bced360d-a02a-4b73-b0e7-46fe5ae1dc34?type=js3&sn=v_4_srv_8_sn_20124DC10D36CDE3D1C555C55D40CA36_perc_100000_ol_0_mul_1_app-3A429b1eac4514c5ce_1_rcs-3Acss_0&svrid=8&flavor=post&vi=OSRWPKERGJKLBVFCIANBBATQHLJBBKCA-0&modifiedSince=1730276476420&rf=https%3A%2F%2Fmybell.bell.ca%2FLogin%3Flanguage%3Den&bp=3&app=429b1eac4514c5ce&crc=3160494552&en=gticcd0a&end=1 HTTP/1.1Host: mybell.bell.caConnection: keep-aliveContent-Length: 622sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://mybell.bell.caSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://mybell.bell.ca/Login?language=enAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BSCC=LoginSplashReturnURL=%2fLogin%3flanguage%3den; 8D711C5DA4B3704F0A5FE8ED0DB141222DFC87ED6AFE3A6E5F0F7DA8B5953F07F9198C1C7587982AE5FDA2B721188A3A=false; FPID=074d78d6-7e50-4974-a9af-c4727a62784e; FPID_2=074d78d6-7e50-4974-a9af-c4727a62784e; SessionCk=e60da217-072c-41c7-969e-7adbf82ba8be; InActivityCK=d0bb8c90-fdf6-4cf3-8894-a30039ae3a23; ConsistentActivityCK=d0bb8c90-fdf6-4cf3-8894-a30039ae3a23; OmniturePageName=Login:; __eccomp=; dtCookie=v_4_srv_8_sn_20124DC10D36CDE3D1C555C55D40CA36_perc_100000_ol_0_mul_1_app-3A429b1eac4514c5ce_1_rcs-3Acss_0; CAD_Bell_ca_SS=967776428.47873.0000; Qjja3xkGs7=3789514188.64288.0000; TLTSID=759A09CF47C23CE7804C25098E01FFA8; TLTUID=26A0122B5E2EB3DDD5D9EB8E4F02EA98; TLP025e8c23=028702b9c92edae6af33052f2cad8391df3643e23d85a115a62dcd733137452f4305eb2ab8d3f82b8b13ae85a95e4a91df25ba1c299bcfdedb4de1548e72df9a4d727dc04ff7a4434f043a9549e2ae990e27c8fffcf8c51f6f45ef28d16623df71e944530154bdbbc943f1778729d75c23d5090b564224b9da5206df5702a68a73781d1fd1ececbd44594c5dd8c5b5254f6f1bde1d0a0592f816ed03e81d2a7361fff6316b97ddde987648e57932628c05ca645ec1dd7f856ec66444e629d0622a68b7e2c134f284f196ea3544cf3b7c82207a54921a6555f20de00c22b2c76ebcdc53eaee7e5f6b642a0290d9cec5131cd8fb109ee0df2b3f4778939a7789ac78056fb9410029bd6003a59e231a02b1e37dbc7850fd5bd1f084ade389122c5bd439ff5038520f0b6ac30f03e31c23ca7289d6d59979f12f660f3dbeb3c0f974d1ad06761c0eda4704077fb3cf009e2239d228a2b96806fe5c793a3730769749ad8989123b; lanAkamaPro=A5IztOKSAQAAfK0hC-Sd8xQWQaTBAexuZE_ULjNr2v-63nNi-QEd9JDirAQvAa3--k2ucgHcwH8AAEB3AAAAAA|1|0|5936127134d4a7470b6c18b8f02213c4d723e799; TLP02ce4a58=028702b9c93a131f183946e5fba2da8acf4264474085a115a62dcd733137452f4305eb2ab84ad0304b853df666ee8067949b77e11784af563bbdb36d1d3f79fb6950541b57; ktlvDW7IG5ClOcxYTbmY=a; rxVisitor=17303803184158NV4F74O1KFTJ2EO5K4UAGQSTA0OEH7F; dtPC=8$580318412_852h1vOSRWPKERGJKLBVFCIANBBATQHLJBBKCA-0e0; dtSa=-; rxvt=1730382118433|1730380318420; TLP409c8162028=08e8c5f15aab2000b61c75eddd03524f4e0b3628000977b6617a486bc1130e994b8dd8528578f28c08e9b

Source: https://mybell.bell.ca/Login?language=en	HTTP Parser: Iframe src: https://bellca.demdex.net/dest5.html?d_nsid=0#https%3A%2F%2Fmybell.bell.ca
Source: https://mybell.bell.ca/Login?language=en	HTTP Parser: Iframe src: https://bellca.demdex.net/dest5.html?d_nsid=0#https%3A%2F%2Fmybell.bell.ca
Source: https://mybell.bell.ca/Login?language=en	HTTP Parser: Iframe src: https://bellca.demdex.net/dest5.html?d_nsid=0#https%3A%2F%2Fmybell.bell.ca
Source: https://mybell.bell.ca/Login?language=en	HTTP Parser: Iframe src: https://bellca.demdex.net/dest5.html?d_nsid=0#https%3A%2F%2Fmybell.bell.ca
Source: https://mybell.bell.ca/Login?language=en	HTTP Parser: Iframe src: https://bellca.demdex.net/dest5.html?d_nsid=0#https%3A%2F%2Fmybell.bell.ca

Source: https://mybell.bell.ca/Login?language=en	HTTP Parser: <input type="password" .../> found
Source: https://mybell.bell.ca/Login?_branch_match_id=1380522052703713689&_branch_referrer=H4sIAAAAAAAAA8soKSkottLXz9VLSs3J0UtO1C8uLSjILyopKkzOT0m1rytKTUstKsrMS49PKsovL04tsnXOKMrPTQUAvip8pzkAAAA%3D#EXT=branch_supportrqcode	HTTP Parser: <input type="password" .../> found

Source: https://mybell.bell.ca/Login?language=en	HTTP Parser: No favicon
Source: https://mybell.bell.ca/Login?language=en	HTTP Parser: No favicon
Source: https://mybell.bell.ca/Login?language=en	HTTP Parser: No favicon
Source: https://support.bell.ca/Billing-and-Accounts/manage_your_bell_services_on_the_go#EXT=MOB_URL_branch_getapploginpage_012423_MH	HTTP Parser: No favicon
Source: https://support.bell.ca/Billing-and-Accounts/manage_your_bell_services_on_the_go#EXT=MOB_URL_branch_getapploginpage_012423_MH	HTTP Parser: No favicon
Source: https://support.bell.ca/Billing-and-Accounts/manage_your_bell_services_on_the_go#EXT=MOB_URL_branch_getapploginpage_012423_MH	HTTP Parser: No favicon
Source: https://support.bell.ca/Billing-and-Accounts/manage_your_bell_services_on_the_go#EXT=MOB_URL_branch_getapploginpage_012423_MH	HTTP Parser: No favicon
Source: https://support.bell.ca/Billing-and-Accounts/manage_your_bell_services_on_the_go#EXT=MOB_URL_branch_getapploginpage_012423_MH	HTTP Parser: No favicon
Source: https://mybell.bell.ca/Login?_branch_match_id=1380522052703713689&_branch_referrer=H4sIAAAAAAAAA8soKSkottLXz9VLSs3J0UtO1C8uLSjILyopKkzOT0m1rytKTUstKsrMS49PKsovL04tsnXOKMrPTQUAvip8pzkAAAA%3D#EXT=branch_supportrqcode	HTTP Parser: No favicon
Source: https://mybell.bell.ca/Login?_branch_match_id=1380522052703713689&_branch_referrer=H4sIAAAAAAAAA8soKSkottLXz9VLSs3J0UtO1C8uLSjILyopKkzOT0m1rytKTUstKsrMS49PKsovL04tsnXOKMrPTQUAvip8pzkAAAA%3D#EXT=branch_supportrqcode	HTTP Parser: No favicon

Source: https://mybell.bell.ca/Login?language=en	HTTP Parser: No <meta name="author".. found
Source: https://mybell.bell.ca/Login?language=en	HTTP Parser: No <meta name="author".. found
Source: https://mybell.bell.ca/Login?language=en	HTTP Parser: No <meta name="author".. found
Source: https://mybell.bell.ca/Login?language=en	HTTP Parser: No <meta name="author".. found
Source: https://mybell.bell.ca/Login?language=en	HTTP Parser: No <meta name="author".. found
Source: https://mybell.bell.ca/Login?language=en	HTTP Parser: No <meta name="author".. found
Source: https://mybell.bell.ca/Login?_branch_match_id=1380522052703713689&_branch_referrer=H4sIAAAAAAAAA8soKSkottLXz9VLSs3J0UtO1C8uLSjILyopKkzOT0m1rytKTUstKsrMS49PKsovL04tsnXOKMrPTQUAvip8pzkAAAA%3D#EXT=branch_supportrqcode	HTTP Parser: No <meta name="author".. found
Source: https://mybell.bell.ca/Login?_branch_match_id=1380522052703713689&_branch_referrer=H4sIAAAAAAAAA8soKSkottLXz9VLSs3J0UtO1C8uLSjILyopKkzOT0m1rytKTUstKsrMS49PKsovL04tsnXOKMrPTQUAvip8pzkAAAA%3D#EXT=branch_supportrqcode	HTTP Parser: No <meta name="author".. found
Source: https://mybell.bell.ca/Login?_branch_match_id=1380522052703713689&_branch_referrer=H4sIAAAAAAAAA8soKSkottLXz9VLSs3J0UtO1C8uLSjILyopKkzOT0m1rytKTUstKsrMS49PKsovL04tsnXOKMrPTQUAvip8pzkAAAA%3D#EXT=branch_supportrqcode	HTTP Parser: No <meta name="author".. found

Source: https://mybell.bell.ca/Login?language=en	HTTP Parser: No <meta name="copyright".. found
Source: https://mybell.bell.ca/Login?language=en	HTTP Parser: No <meta name="copyright".. found
Source: https://mybell.bell.ca/Login?language=en	HTTP Parser: No <meta name="copyright".. found
Source: https://mybell.bell.ca/Login?language=en	HTTP Parser: No <meta name="copyright".. found
Source: https://mybell.bell.ca/Login?language=en	HTTP Parser: No <meta name="copyright".. found
Source: https://mybell.bell.ca/Login?language=en	HTTP Parser: No <meta name="copyright".. found
Source: https://mybell.bell.ca/Login?_branch_match_id=1380522052703713689&_branch_referrer=H4sIAAAAAAAAA8soKSkottLXz9VLSs3J0UtO1C8uLSjILyopKkzOT0m1rytKTUstKsrMS49PKsovL04tsnXOKMrPTQUAvip8pzkAAAA%3D#EXT=branch_supportrqcode	HTTP Parser: No <meta name="copyright".. found
Source: https://mybell.bell.ca/Login?_branch_match_id=1380522052703713689&_branch_referrer=H4sIAAAAAAAAA8soKSkottLXz9VLSs3J0UtO1C8uLSjILyopKkzOT0m1rytKTUstKsrMS49PKsovL04tsnXOKMrPTQUAvip8pzkAAAA%3D#EXT=branch_supportrqcode	HTTP Parser: No <meta name="copyright".. found
Source: https://mybell.bell.ca/Login?_branch_match_id=1380522052703713689&_branch_referrer=H4sIAAAAAAAAA8soKSkottLXz9VLSs3J0UtO1C8uLSjILyopKkzOT0m1rytKTUstKsrMS49PKsovL04tsnXOKMrPTQUAvip8pzkAAAA%3D#EXT=branch_supportrqcode	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:50262 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:50470 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:50472 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:50473 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:50474 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:50497 version: TLS 1.2

Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.9:50026 -> 87.248.119.252:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.9:50057 -> 87.248.119.251:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.9:50346 -> 142.250.185.174:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.9:50651 -> 104.244.42.3:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.9:50652 -> 172.66.0.227:443

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: chromecache_391.2.dr, chromecache_503.2.dr	String found in binary or memory: const defaultSource = 'https://www.youtube.com/embed/'; equals www.youtube.com (Youtube)
Source: chromecache_391.2.dr, chromecache_503.2.dr	String found in binary or memory: const defaultSource = 'https://www.youtube.com/embed/'; equals www.youtube.com (Youtube)
Source: chromecache_391.2.dr, chromecache_503.2.dr	String found in binary or memory: tag.src = 'https://www.youtube.com/iframe_api'; equals www.youtube.com (Youtube)
Source: chromecache_391.2.dr, chromecache_503.2.dr	String found in binary or memory: tag.src = 'https://www.youtube.com/iframe_api'; equals www.youtube.com (Youtube)
Source: chromecache_315.2.dr, chromecache_436.2.dr, chromecache_479.2.dr, chromecache_468.2.dr	String found in binary or memory: Math.round(q);t["gtm.videoElapsedTime"]=Math.round(f);t["gtm.videoPercent"]=r;t["gtm.videoVisible"]=u;return t},rk:function(){e=pb()},zd:function(){d()}}};var Yb=ka(["data-gtm-yt-inspected-"]),nD=["www.youtube.com","www.youtube-nocookie.com"],oD,pD=!1; equals www.youtube.com (Youtube)
Source: chromecache_478.2.dr, chromecache_438.2.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=UA(a,c,e);S(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return S(122),!0;if(d&&f){for(var m=Ab(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},XA=function(){var a=[],b=function(c){return db(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_403.2.dr, chromecache_325.2.dr	String found in binary or memory: function X(a,b){this.v={};this.playerInfo={};this.videoTitle="";this.j=this.g=null;this.h=0;this.m=!1;this.l=[];this.i=null;this.A={};this.options=null;if(!a)throw Error("YouTube player element ID required.");this.id=qa(this);b=Object.assign({title:"video player",videoId:"",width:640,height:360},b\|\|{});var c=document;if(a=typeof a==="string"?c.getElementById(a):a){W.yt_embedsEnableRsaforFromIframeApi&&tb();c=a.tagName.toLowerCase()==="iframe";b.host\|\|(b.host=c?mb(a.src):"https://www.youtube.com");this.options= equals www.youtube.com (Youtube)
Source: chromecache_403.2.dr, chromecache_325.2.dr	String found in binary or memory: function tb(){var a=new rb,b=["https://www.youtube.com"];b=b===void 0?qb:b;oa(function(c){switch(c.g){case 1:return C(c,sb(),2);case 2:if(!c.m){c.g=3;break}return C(c,Promise.all(b.map(function(d){var g;return oa(function(k){if(k.g==1)return k.l=2,C(k,navigator.permissions.query({name:"top-level-storage-access",requestedOrigin:d}),4);k.g!=2?(g=k.m,g.state==="prompt"&&a.g.push(d),k.g=0,k.l=0):(k.l=0,k.i=null,k.g=0)})})),4); equals www.youtube.com (Youtube)
Source: chromecache_315.2.dr, chromecache_436.2.dr, chromecache_479.2.dr, chromecache_468.2.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={Ah:e,yh:f,zh:g,ii:k,ji:m,Qe:n,Ib:b},q=C.YT;if(q)return q.ready&&q.ready(d),b;var r=C.onYouTubeIframeAPIReady;C.onYouTubeIframeAPIReady=function(){r&&r();d()};G(function(){for(var u=E.getElementsByTagName("script"),v=u.length,t=0;t<v;t++){var w=u[t].getAttribute("src");if(yD(w,"iframe_api")\|\|yD(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!pD&&wD(x[A],p.Qe))return oc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_478.2.dr, chromecache_438.2.dr	String found in binary or memory: return b}lD.F="internal.enableAutoEventOnTimer";var Yb=ka(["data-gtm-yt-inspected-"]),nD=["www.youtube.com","www.youtube-nocookie.com"],oD,pD=!1; equals www.youtube.com (Youtube)
Source: chromecache_478.2.dr, chromecache_438.2.dr	String found in binary or memory: var AC=function(a,b,c,d,e){var f=rA("fsl",c?"nv.mwt":"mwt",0),g;g=c?rA("fsl","nv.ids",[]):rA("fsl","ids",[]);if(!g.length)return!0;var k=wA(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);S(121);if(m==="https://www.facebook.com/tr/")return S(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!dz(k,fz(b, equals www.facebook.com (Facebook)
Source: chromecache_454.2.dr	String found in binary or memory: var scriptUrl = 'https:\/\/www.youtube.com\/s\/player\/78fcc867\/www-widgetapi.vflset\/www-widgetapi.js';try{var ttPolicy=window.trustedTypes.createPolicy("youtube-widget-api",{createScriptURL:function(x){return x}});scriptUrl=ttPolicy.createScriptURL(scriptUrl)}catch(e){}var YT;if(!window["YT"])YT={loading:0,loaded:0};var YTConfig;if(!window["YTConfig"])YTConfig={"host":"https://www.youtube.com"}; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: mybell.bell.ca
Source: global traffic	DNS traffic detected: DNS query: www.bell.ca
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: assets.adobedtm.com
Source: global traffic	DNS traffic detected: DNS query: m.bell.ca
Source: global traffic	DNS traffic detected: DNS query: dpm.demdex.net
Source: global traffic	DNS traffic detected: DNS query: bell.app.link
Source: global traffic	DNS traffic detected: DNS query: bellca.demdex.net
Source: global traffic	DNS traffic detected: DNS query: somni.bell.ca
Source: global traffic	DNS traffic detected: DNS query: collection.decibelinsight.net
Source: global traffic	DNS traffic detected: DNS query: cdn.decibelinsight.net
Source: global traffic	DNS traffic detected: DNS query: cm.everesttech.net
Source: global traffic	DNS traffic detected: DNS query: cdn.branch.io
Source: global traffic	DNS traffic detected: DNS query: support.bell.ca
Source: global traffic	DNS traffic detected: DNS query: cm.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: match.adsrvr.org
Source: global traffic	DNS traffic detected: DNS query: app.link
Source: global traffic	DNS traffic detected: DNS query: api2.branch.io
Source: global traffic	DNS traffic detected: DNS query: ml314.com
Source: global traffic	DNS traffic detected: DNS query: s.go-mpulse.net
Source: global traffic	DNS traffic detected: DNS query: ps.eyeota.net
Source: global traffic	DNS traffic detected: DNS query: cms.analytics.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: ads.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: sync.crwdcntrl.net
Source: global traffic	DNS traffic detected: DNS query: ups.analytics.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: resources.digital-cloud.medallia.ca
Source: global traffic	DNS traffic detected: DNS query: s.amazon-adsystem.com
Source: global traffic	DNS traffic detected: DNS query: c.go-mpulse.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: data1.bell.ca
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: analytics-fe.digital-cloud.medallia.ca
Source: global traffic	DNS traffic detected: DNS query: udc-neb.kampyle.com
Source: global traffic	DNS traffic detected: DNS query: 02179915.akstat.io
Source: global traffic	DNS traffic detected: DNS query: trial-eum-clientnsv4-s.akamaihd.net
Source: global traffic	DNS traffic detected: DNS query: trial-eum-clienttons-s.akamaihd.net
Source: global traffic	DNS traffic detected: DNS query: vx7putk7mu3ggzzdqjka-pib559-61906c0f2-clientnsv4-s.akamaihd.net
Source: global traffic	DNS traffic detected: DNS query: 173-254-250-77_s-2-16-164-104_ts-1730380372-clienttons-s.akamaihd.net
Source: global traffic	DNS traffic detected: DNS query: siteimproveanalytics.com
Source: global traffic	DNS traffic detected: DNS query: static.ads-twitter.com
Source: global traffic	DNS traffic detected: DNS query: analytics.tiktok.com
Source: global traffic	DNS traffic detected: DNS query: sc-static.net
Source: global traffic	DNS traffic detected: DNS query: snap.licdn.com
Source: global traffic	DNS traffic detected: DNS query: px.ads.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: www.clarity.ms
Source: global traffic	DNS traffic detected: DNS query: www.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: c.clarity.ms
Source: global traffic	DNS traffic detected: DNS query: t.co
Source: global traffic	DNS traffic detected: DNS query: analytics.twitter.com
Source: global traffic	DNS traffic detected: DNS query: t.clarity.ms

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 18Connection: closeAccess-Control-Allow-Origin: *Date: Thu, 31 Oct 2024 13:12:20 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsX-Powered-By: BranchX-Cache: Error from cloudfrontVia: 1.1 0e358bffbd534852f8496b34da6ad3e4.cloudfront.net (CloudFront)X-Amz-Cf-Pop: FRA56-P7X-Amz-Cf-Id: EEDMzhZDF0dbmVVMf4DH9hFub4-8qv_SmIbthWpSk3cz_KZvz1MTsg==
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 18Connection: closeAccess-Control-Allow-Origin: *Date: Thu, 31 Oct 2024 13:12:24 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsX-Powered-By: BranchX-Cache: Error from cloudfrontVia: 1.1 85310f8b6878a9cfaa0218e021ae364e.cloudfront.net (CloudFront)X-Amz-Cf-Pop: FRA56-P7X-Amz-Cf-Id: g7NsaJ_CLUJb4qYMzId7PMWi8H2wTOBlfMYd1c80Xg6J3kj1d2Xk1Q==
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 18Connection: closeAccess-Control-Allow-Origin: *Date: Thu, 31 Oct 2024 13:12:54 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsX-Powered-By: BranchX-Cache: Error from cloudfrontVia: 1.1 f3d57c6f1e03e389abd50b7f7535cee4.cloudfront.net (CloudFront)X-Amz-Cf-Pop: FRA56-P7X-Amz-Cf-Id: 47rJRvWi-zoI3TBxSriakQPrazzhJMmPoq7cNssr6YtbxkZnsAk9sQ==
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 18Connection: closeAccess-Control-Allow-Origin: *Date: Thu, 31 Oct 2024 13:12:57 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsX-Powered-By: BranchX-Cache: Error from cloudfrontVia: 1.1 a5010656f4f762c0fdffac3448496b86.cloudfront.net (CloudFront)X-Amz-Cf-Pop: FRA56-P7X-Amz-Cf-Id: IyAUSNmOYVH9RuIFxGAPZlxoYCDtRab4MHbsPNwVuLXP5RexYZqdYg==
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 18Connection: closeAccess-Control-Allow-Origin: *Date: Thu, 31 Oct 2024 13:13:06 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsX-Powered-By: BranchX-Cache: Error from cloudfrontVia: 1.1 6be461c5a9399007c1540eee90371674.cloudfront.net (CloudFront)X-Amz-Cf-Pop: FRA56-P7X-Amz-Cf-Id: JddLa7EAoLO7NJZGXENVUbNHFZI9dzlEGe1k1PqX0pp9gBbb4vmF_Q==
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 18Connection: closeAccess-Control-Allow-Origin: *Date: Thu, 31 Oct 2024 13:13:06 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsX-Powered-By: BranchX-Cache: Error from cloudfrontVia: 1.1 9672a97668a5842cedcfaee3e743019e.cloudfront.net (CloudFront)X-Amz-Cf-Pop: FRA56-P7X-Amz-Cf-Id: Cwq3PxH6F1O8aGmSAi3s9nf0h8hF1Vl1bsMLmfAXDuCuIEznVMNheA==

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2264,i,8939700929347395739,7703461295604259672,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://mybell.bell.ca/Login?language=en"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4184 --field-trial-handle=2264,i,8939700929347395739,7703461295604259672,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4608 --field-trial-handle=2264,i,8939700929347395739,7703461295604259672,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://m.bell.ca/getapploginpage
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1656 --field-trial-handle=1064,i,6441221849923588881,12403408043935428112,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://m.bell.ca/supportrqcode
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1616 --field-trial-handle=2012,i,16209123222516514220,5828609412293976285,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2264,i,8939700929347395739,7703461295604259672,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4184 --field-trial-handle=2264,i,8939700929347395739,7703461295604259672,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4608 --field-trial-handle=2264,i,8939700929347395739,7703461295604259672,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1656 --field-trial-handle=1064,i,6441221849923588881,12403408043935428112,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1616 --field-trial-handle=2012,i,16209123222516514220,5828609412293976285,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://stats.g.doubleclick.net/g/collect	0%	URL Reputation	safe
https://developers.google.com/recaptcha/docs/faq#localhost_support	0%	URL Reputation	safe
https://support.google.com/recaptcha/#6175971	0%	URL Reputation	safe
https://support.google.com/recaptcha	0%	URL Reputation	safe
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que	0%	URL Reputation	safe
https://sc-static.net/scevent.min.js	0%	URL Reputation	safe
https://www.clarity.ms/tag/uet/	0%	URL Reputation	safe
https://developers.google.com/youtube/iframe_api_reference#Events	0%	URL Reputation	safe
https://cloud.google.com/contact	0%	URL Reputation	safe
http://kenwheeler.github.io/slick	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
app.link	18.239.18.118	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
platform.twitter.map.fastly.net	199.232.188.157	true	false	unknown
collection.decibelinsight.net	130.61.120.2	true	false	unknown
stats.g.doubleclick.net	64.233.167.157	true	false	unknown
adobetarget.data.adobedc.net	66.235.152.225	true	false	unknown
ps.eyeota.net	18.184.216.10	true	false	unknown
scontent.xx.fbcdn.net	157.240.0.6	true	false	unknown
t.co	172.66.0.227	true	false	unknown
bell.app.link	18.239.18.88	true	false	unknown
sync.crwdcntrl.net	54.194.72.83	true	false	unknown
d1tcwf12y4kqv3.cloudfront.net	18.65.39.29	true	false	unknown
cm.g.doubleclick.net	142.250.185.130	true	false	unknown
www.google.com	216.58.206.36	true	false	unknown
dcs-ups.g03.yahoodns.net	87.248.119.252	true	false	unknown
dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com	52.50.97.18	true	false	unknown
custom.bnc.lt	52.9.108.223	true	false	unknown
medallia2.map.fastly.net	146.75.117.230	true	false	unknown
match.adsrvr.org	52.223.40.198	true	false	unknown
siteimproveanalytics.com	188.114.96.3	true	false	unknown
ax-0001.ax-dc-msedge.net	150.171.29.10	true	false	unknown
s.twitter.com	104.244.42.3	true	false	unknown
cdn.branch.io	18.66.27.34	true	false	unknown
s.amazon-adsystem.com	98.82.156.107	true	false	unknown
sc-static.net	143.204.207.250	true	false	unknown
bell.ca.ssl.sc.omtrdc.net	63.140.62.17	true	false	unknown
s-part-0017.t-0009.fb-t-msedge.net	13.107.253.45	true	false	unknown
mybell-on-priority.gdns.bell.ca	206.47.98.207	true	false	unknown
ax-0001.ax-msedge.net	150.171.28.10	true	false	unknown
youtube-ui.l.google.com	142.250.186.174	true	false	unknown
googleads.g.doubleclick.net	142.250.186.98	true	false	unknown
digital.lb.can.medallia.ca	147.75.178.60	true	false	unknown
td.doubleclick.net	142.250.186.98	true	false	unknown
analytics.google.com	142.250.185.174	true	false	unknown
ml314.com	34.117.77.79	true	false	unknown
cooladata.kampyle.com	35.241.45.82	true	false	unknown
cdn.decibelinsight.net	130.61.120.2	true	false	unknown
api2.branch.io	108.156.60.64	true	false	unknown
static.ads-twitter.com	unknown	unknown	false	unknown
vx7putk7mu3ggzzdqjka-pib559-61906c0f2-clientnsv4-s.akamaihd.net	unknown	unknown	false	unknown
t.clarity.ms	unknown	unknown	false	unknown
www.bell.ca	unknown	unknown	false	unknown
cm.everesttech.net	unknown	unknown	false	unknown
m.bell.ca	unknown	unknown	false	unknown
trial-eum-clientnsv4-s.akamaihd.net	unknown	unknown	false	unknown
resources.digital-cloud.medallia.ca	unknown	unknown	false	unknown
www.youtube.com	unknown	unknown	false	unknown
c.clarity.ms	unknown	unknown	false	unknown
data1.bell.ca	unknown	unknown	false	unknown
assets.adobedtm.com	unknown	unknown	false	unknown
173-254-250-77_s-2-16-164-104_ts-1730380372-clienttons-s.akamaihd.net	unknown	unknown	false	unknown
trial-eum-clienttons-s.akamaihd.net	unknown	unknown	false	unknown
connect.facebook.net	unknown	unknown	false	unknown
px.ads.linkedin.com	unknown	unknown	false	unknown
cms.analytics.yahoo.com	unknown	unknown	false	unknown
02179915.akstat.io	unknown	unknown	false	unknown
somni.bell.ca	unknown	unknown	false	unknown
s.go-mpulse.net	unknown	unknown	false	unknown
ups.analytics.yahoo.com	unknown	unknown	false	unknown
udc-neb.kampyle.com	unknown	unknown	false	unknown
ads.scorecardresearch.com	unknown	unknown	false	unknown
dpm.demdex.net	unknown	unknown	false	unknown
mybell.bell.ca	unknown	unknown	false	unknown
support.bell.ca	unknown	unknown	false	unknown
www.clarity.ms	unknown	unknown	false	unknown
www.linkedin.com	unknown	unknown	false	unknown
analytics-fe.digital-cloud.medallia.ca	unknown	unknown	false	unknown
analytics.twitter.com	unknown	unknown	false	unknown
bellca.demdex.net	unknown	unknown	false	unknown
snap.licdn.com	unknown	unknown	false	unknown
analytics.tiktok.com	unknown	unknown	false	unknown
c.go-mpulse.net	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://collection.decibelinsight.net/i/14028/da/?type=page&wid=693653&sid=84E654F18AD2AE89A616AA13A6B4CC6A8F&jspsf=1&pvid=1730380363135&dc=1&dv=1&dl=384&retryCode=socketNotConnected	false		unknown
https://collection.decibelinsight.net/i/14028/da/?type=multi&wid=693653&sid=84E654F18AD2AE89A616AA13A6B4CC6A8F&jspsf=1&pvid=1730380341691&dc=14&dv=1&dl=1354	false		unknown
https://mybell.bell.ca/rb_bced360d-a02a-4b73-b0e7-46fe5ae1dc34?type=js3&sn=v_4_srv_8_sn_20124DC10D36CDE3D1C555C55D40CA36_perc_100000_ol_0_mul_1_app-3A429b1eac4514c5ce_1_rcs-3Acss_0&svrid=8&flavor=post&vi=OSRWPKERGJKLBVFCIANBBATQHLJBBKCA-0&modifiedSince=1730276476420&rf=https%3A%2F%2Fmybell.bell.ca%2FLogin%3F_branch_match_id%3D1380522052703713689%26_branch_referrer%3DH4sIAAAAAAAAA8soKSkottLXz9VLSs3J0UtO1C8uLSjILyopKkzOT0m1rytKTUstKsrMS49PKsovL04tsnXOKMrPTQUAvip8pzkAAAA%253D%23EXT%3Dbranch_supportrqcode&bp=3&app=429b1eac4514c5ce&crc=388109577&en=gticcd0a&end=1	false		unknown
https://m.bell.ca/supportrqcode	false		unknown
https://mybell.bell.ca/rb_bced360d-a02a-4b73-b0e7-46fe5ae1dc34?type=js3&sn=v_4_srv_8_sn_20124DC10D36CDE3D1C555C55D40CA36_perc_100000_ol_0_mul_1_app-3A429b1eac4514c5ce_1_rcs-3Acss_0&svrid=8&flavor=post&vi=OSRWPKERGJKLBVFCIANBBATQHLJBBKCA-0&modifiedSince=1730276476420&rf=https%3A%2F%2Fmybell.bell.ca%2FLogin%3F_branch_match_id%3D1380522052703713689%26_branch_referrer%3DH4sIAAAAAAAAA8soKSkottLXz9VLSs3J0UtO1C8uLSjILyopKkzOT0m1rytKTUstKsrMS49PKsovL04tsnXOKMrPTQUAvip8pzkAAAA%253D%23EXT%3Dbranch_supportrqcode&bp=3&app=429b1eac4514c5ce&crc=3542311136&en=gticcd0a&end=1	false		unknown
https://data1.bell.ca/b/ss/bellca/10/JS-2.22.0-LEWM/s07531857333589?AQB=1&pccr=true&vidn=3391C12C6C666643-60000C7282CE47AF&g=none&AQE=1	false		unknown
https://siteimproveanalytics.com/js/siteanalyze_1154.js	false		unknown
https://m.bell.ca/getapploginpage	false		unknown
https://collection.decibelinsight.net/i/14028/da/?type=multi&wid=693653&sid=84E654F18AD2AE89A616AA13A6B4CC6A8F&jspsf=1&pvid=1730380363135&dc=12&dv=1&dl=74&retryCode=socketNotConnected	false		unknown
https://www.clarity.ms/tag/uet/19004038	false		unknown
https://collection.decibelinsight.net/i/14028/da/?type=multi&wid=693653&sid=84E654F18AD2AE89A616AA13A6B4CC6A8F&jspsf=1&pvid=1730380363135&dc=16&dv=1&dl=324&retryCode=socketNotConnected	false		unknown
https://collection.decibelinsight.net/i/14028/da/?type=multi&wid=693653&sid=84E654F18AD2AE89A616AA13A6B4CC6A8F&jspsf=1&pvid=1730380363135&dc=14&dv=1&dl=67&retryCode=socketNotConnected	false		unknown
https://collection.decibelinsight.net/i/14028/da/?type=multi&wid=693653&sid=84E654F18AD2AE89A616AA13A6B4CC6A8F&jspsf=1&pvid=1730380363135&dc=21&dv=1&dl=310	false		unknown
https://mybell.bell.ca/rb_bced360d-a02a-4b73-b0e7-46fe5ae1dc34?type=js3&sn=v_4_srv_8_sn_20124DC10D36CDE3D1C555C55D40CA36_perc_100000_ol_0_mul_1_app-3A429b1eac4514c5ce_1_rcs-3Acss_0&svrid=8&flavor=post&vi=OSRWPKERGJKLBVFCIANBBATQHLJBBKCA-0&modifiedSince=1730276476420&rf=https%3A%2F%2Fmybell.bell.ca%2FLogin%3F_branch_match_id%3D1380522052703713689%26_branch_referrer%3DH4sIAAAAAAAAA8soKSkottLXz9VLSs3J0UtO1C8uLSjILyopKkzOT0m1rytKTUstKsrMS49PKsovL04tsnXOKMrPTQUAvip8pzkAAAA%253D%23EXT%3Dbranch_supportrqcode&bp=3&app=429b1eac4514c5ce&crc=1467579985&en=gticcd0a&end=1	false		unknown
https://mybell.bell.ca//Web/MYB/custom/image/echat/assets/Chat-Button-Bubbles(D).png	false		unknown
https://mybell.bell.ca/Login?_branch_match_id=1380522052703713689&_branch_referrer=H4sIAAAAAAAAA8soKSkottLXz9VLSs3J0UtO1C8uLSjILyopKkzOT0m1rytKTUstKsrMS49PKsovL04tsnXOKMrPTQUAvip8pzkAAAA%3D	false		unknown
https://www.google.com/recaptcha/enterprise/webworker.js?hl=en&v=-ZG7BC9TxCVEbzIO2m429usb	false		unknown
https://dpm.demdex.net/ibs:dpid=903&dpuuid=d5095770-96af-43e0-8b13-9a680ab5a9e6	false		unknown
https://ups.analytics.yahoo.com/ups/58782/cms?partner_id=ADOBE&_hosted_id=26594250982175076714259318767746782479&gdpr=0&gdpr_consent=&uid=26594250982175076714259318767746782479&verify=true	false		unknown
https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=MjY1OTQyNTA5ODIxNzUwNzY3MTQyNTkzMTg3Njc3NDY3ODI0Nzk=&google_tc=	false		unknown
https://api2.branch.io/v1/open	false		unknown
https://resources.digital-cloud.medallia.ca/wdccan/36793/onsite/embed.js	false		unknown
https://bell.app.link/9hb8rBafRwb?_p=c11334dc9a0760eee0188ee3efb2	false		unknown
https://collection.decibelinsight.net/i/14028/da/?type=multi&wid=693653&sid=84E654F18AD2AE89A616AA13A6B4CC6A8F&jspsf=1&pvid=1730380341691&dc=28&dv=1&dl=316	false		unknown
https://mybell.bell.ca/rb_bced360d-a02a-4b73-b0e7-46fe5ae1dc34?type=js3&sn=v_4_srv_8_sn_20124DC10D36CDE3D1C555C55D40CA36_perc_100000_ol_0_mul_1_app-3A429b1eac4514c5ce_1_rcs-3Acss_0&svrid=8&flavor=post&vi=OSRWPKERGJKLBVFCIANBBATQHLJBBKCA-0&modifiedSince=1730276476420&rf=https%3A%2F%2Fmybell.bell.ca%2FLogin%3Flanguage%3Den&bp=3&app=429b1eac4514c5ce&crc=3627224120&en=gticcd0a&end=1	false		unknown
https://collection.decibelinsight.net/i/14028/da/?type=multi&wid=693653&sid=84E654F18AD2AE89A616AA13A6B4CC6A8F&jspsf=1&pvid=1730380363135&dc=6&dv=1&dl=157&retryCode=socketNotConnected	false		unknown
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEBplPp3DJvzinu148tIAFz8&google_cver=1?gdpr=0&gdpr_consent=	false		unknown
https://collection.decibelinsight.net/i/14028/da/?type=multi&wid=693653&sid=84E654F18AD2AE89A616AA13A6B4CC6A8F&jspsf=1&pvid=1730380341691&dc=16&dv=1&dl=188	false		unknown
https://mybell.bell.ca/static/bell_common.js?cache	false		unknown
https://data1.bell.ca/b/ss/bellca/10/JS-2.22.0-LEWM/s08712474510957?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=31%2F9%2F2024%209%3A12%3A25%204%20240&d.&nsid=0&jsonv=1&.d&sdid=03870B84460DADFF-291E557ADEB59CD2&mid=26404690240998747124274156036452379072&aamlh=6&ce=UTF-8&cdp=2&pageName=Login&g=https%3A%2F%2Fmybell.bell.ca%2FLogin%3Flanguage%3Den&c.&di_session_id_ms=0.00&di_launch_lib_ms=14123.70&di_session_id=di-693653-84E654F18AD2AE89A616AA13A6B4CC6A8F&.c&cc=CAD&ch=Login&server=xdqn9denqtys%2F4vqsiohi0zc%2B409oxcu1obi2gvjxyy%3D&events=event1%2Cevent19%2Cevent39%2Cevent83%2Cevent151&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c1=D%3Dv1&v1=false&v3=false&c6=D%3Dv135&c9=Login&c10=D%3Dv46&c12=D%3Dv3&c13=D%3Dv31&c14=https%3A%2F%2Fmybell.bell.ca%2Flogin&v14=D%3Dv13&c16=D%3Dv18&c21=D%3Dv21&v21=en-on&v23=759a09cf-47c2-3ce7-804c-25098e01ffa8&v29=D%3Dv25&v30=001&c32=D%3Dv2&v32=26404690240998747124274156036452379072&c33=Login&c36=D%3Dv36&v36=Thursday-9%3A00AM&c37=D%3Dv37&v37=1&c44=D%3Dv102&c45=No%20Referrer&v46=Login&c50=LAUNCH%5Bproduction%20Published%20on%3A%202024-10-29T16%3A55%3A46Z%5D&v51=https%3A%2F%2Fmybell.bell.ca%2FLogin%3Flanguage%3Den&c55=D%3Dv77&c57=D%3Dv30&c58=D%3Dv60&v64=dock%20is%20not%20present%3Ai&c65=2024-10-31%2C09%3A12%3A24.002%2C2024-10-31%2C09%3A11%3A53.540&v67=e60da217-072c-41c7-969e-7adbf82ba8be%3A759a09cf-47c2-3ce7-804c-25098e01ffa8&c68=Login&c70=D%3DUser-Agent&c73=D%3Dv17&c75=Login&v75=D%3DUser-Agent&v77=001-1-0&v103=Launch%20%7Casync&v136=User&v145=Page%20load&v151=di-693653-84E654F18AD2AE89A616AA13A6B4CC6A8F&v160=074d78d6-7e50-4974-a9af-c4727a62784e&v162=d0bb8c90-fdf6-4cf3-8894-a30039ae3a23&v179=not%20available&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=48B034FA53CF9FD10A490D44%40AdobeOrg&AQE=1	false		unknown
https://bell.app.link/wG8vjg7lLgb?_p=c11334dc9a0760eee0188ee3efb2	false		unknown
https://mybell.bell.ca/rb_bced360d-a02a-4b73-b0e7-46fe5ae1dc34?type=js3&sn=v_4_srv_8_sn_20124DC10D36CDE3D1C555C55D40CA36_perc_100000_ol_0_mul_1_app-3A429b1eac4514c5ce_1_rcs-3Acss_0&svrid=8&flavor=post&vi=OSRWPKERGJKLBVFCIANBBATQHLJBBKCA-0&modifiedSince=1730276476420&rf=https%3A%2F%2Fmybell.bell.ca%2FLogin%3Flanguage%3Den&bp=3&app=429b1eac4514c5ce&crc=2219907894&en=gticcd0a&end=1	false		unknown
https://collection.decibelinsight.net/i/14028/da/?type=multi&wid=693653&sid=84E654F18AD2AE89A616AA13A6B4CC6A8F&jspsf=1&pvid=1730380363135&dc=5&dv=1&dl=387&retryCode=socketNotConnected	false		unknown
https://sync.crwdcntrl.net/map/c=9828/tp=ADBE/gdpr=0/gdpr_consent=/tpid=26594250982175076714259318767746782479?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D121998%26dpuuid%3D${profile_id}	false		unknown
https://app.link/_r?sdk=web2.85.0&branch_key=key_live_adAu45V2R6wos7hoIYdA7flfytp07fPD&callback=branch_callback__1	false		unknown
https://app.link/_r?sdk=web2.85.0&branch_key=key_live_adAu45V2R6wos7hoIYdA7flfytp07fPD&callback=branch_callback__0	false		unknown
https://collection.decibelinsight.net/i/14028/da/?type=multi&wid=693653&sid=84E654F18AD2AE89A616AA13A6B4CC6A8F&jspsf=1&pvid=1730380363135&dc=3&dv=1&dl=726&retryCode=socketNotConnected	false		unknown
https://collection.decibelinsight.net/i/14028/da/?type=multi&wid=693653&sid=84E654F18AD2AE89A616AA13A6B4CC6A8F&jspsf=1&pvid=1730380341691&dc=21&dv=1&dl=1875	false		unknown
https://collection.decibelinsight.net/i/14028/da/?type=multi&wid=693653&sid=84E654F18AD2AE89A616AA13A6B4CC6A8F&jspsf=1&pvid=1730380363135&dc=20&dv=1&dl=1009	false		unknown
https://cdn.decibelinsight.net/i/14028/693653/di.js	false		unknown
https://mybell.bell.ca/ruxitagentjs_D_10299241001084140.js	false		unknown
https://collection.decibelinsight.net/i/14028/da/?type=multi&wid=693653&sid=84E654F18AD2AE89A616AA13A6B4CC6A8F&jspsf=1&pvid=1730380341691&dc=12&dv=1&dl=1094&retryCode=socketNotConnected	false		unknown
https://ads.scorecardresearch.com/p?c1=9&c2=6034944&c3=2&cs_xi=26594250982175076714259318767746782479&rn=1730380329900&r=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D73426%26dpuuid%3D26594250982175076714259318767746782479	false		unknown
https://collection.decibelinsight.net/i/14028/da/?type=multi&wid=693653&sid=84E654F18AD2AE89A616AA13A6B4CC6A8F&jspsf=1&pvid=1730380341691&dc=15&dv=1&dl=193	false		unknown
https://sc-static.net/scevent.min.js	false	URL Reputation: safe	unknown
https://data1.bell.ca/b/ss/bellca/10/JS-2.22.0-LEWM/s07531857333589	false		unknown
https://collection.decibelinsight.net/i/14028/da/?type=browser&wid=693653&sid=84E654F18AD2AE89A616AA13A6B4CC6A8F&jspsf=1&pvid=1730380341691&dc=8&dv=1&dl=64&retryCode=socketNotConnected	false		unknown
https://bellca.demdex.net/dest5.html?d_nsid=0	false		unknown
https://mybell.bell.ca/Styles/RSX/mybell/img/img_login_MyBell_June2021.jpg	false		unknown
https://collection.decibelinsight.net/i/14028/da/?type=multi&wid=693653&sid=84E654F18AD2AE89A616AA13A6B4CC6A8F&jspsf=1&pvid=1730380341691&dc=26&dv=1&dl=981	false		unknown
https://mybell.bell.ca/favicon.ico	false		unknown
https://analytics.twitter.com/i/adsct?bci=3&dv=America%2FNew_York%26en-US%2Cen%26Google%20Inc.%26Win32%26255%261280%261024%264%2624%261280%26984%260%26na&eci=2&event_id=75dbc205-4c8a-4a77-8628-dfd61cc8e74e&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=1322545b-b665-4048-b0ef-15df58eb134e&tw_document_href=https%3A%2F%2Fsupport.bell.ca%2FBilling-and-Accounts%2Fmanage_your_bell_services_on_the_go%23EXT%3DMOB_URL_branch_getapploginpage_012423_MH&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nu9ts&type=javascript&version=2.3.31	false		unknown
https://collection.decibelinsight.net/i/14028/da/?type=browser&wid=693653&sid=84E654F18AD2AE89A616AA13A6B4CC6A8F&jspsf=1&pvid=1730380363135&dc=15&dv=1&dl=64&retryCode=socketNotConnected	false		unknown
https://collection.decibelinsight.net/i/14028/da/?type=multi&wid=693653&sid=84E654F18AD2AE89A616AA13A6B4CC6A8F&jspsf=1&pvid=1730380361972&dc=9&dv=1&dl=132	false		unknown
https://mybell.bell.ca/Web/MYB/custom/css/eChat/eChat-Light.min.css	false		unknown
https://t.co/i/adsct?bci=3&dv=America%2FNew_York%26en-US%2Cen%26Google%20Inc.%26Win32%26255%261280%261024%264%2624%261280%26984%260%26na&eci=2&event_id=75dbc205-4c8a-4a77-8628-dfd61cc8e74e&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=1322545b-b665-4048-b0ef-15df58eb134e&tw_document_href=https%3A%2F%2Fsupport.bell.ca%2FBilling-and-Accounts%2Fmanage_your_bell_services_on_the_go%23EXT%3DMOB_URL_branch_getapploginpage_012423_MH&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nu9ts&type=javascript&version=2.3.31	false		unknown
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZyOCLgAAAGAnoQN6	false		unknown
https://connect.facebook.net/en_US/all.js	false		unknown
https://collection.decibelinsight.net/i/14028/da/?type=multi&wid=693653&sid=84E654F18AD2AE89A616AA13A6B4CC6A8F&jspsf=1&pvid=1730380363135&dc=4&dv=1&dl=128&retryCode=socketNotConnected	false		unknown
https://collection.decibelinsight.net/i/14028/da/?type=html&wid=693653&sid=84E654F18AD2AE89A616AA13A6B4CC6A8F&jspsf=1&pvid=1730380361972&dc=7&dv=1&dl=129290	false		unknown
https://collection.decibelinsight.net/i/14028/da/?type=multi&wid=693653&sid=84E654F18AD2AE89A616AA13A6B4CC6A8F&jspsf=1&pvid=1730380363135&dc=7&dv=1&dl=70&retryCode=socketNotConnected	false		unknown
https://collection.decibelinsight.net/i/14028/da/?type=page&wid=693653&sid=84E654F18AD2AE89A616AA13A6B4CC6A8F&jspsf=1&pvid=1730380341691&dc=1&dv=1&dl=397&retryCode=socketNotConnected	false		unknown
https://collection.decibelinsight.net/i/14028/da/?type=multi&wid=693653&sid=84E654F18AD2AE89A616AA13A6B4CC6A8F&jspsf=1&pvid=1730380341691&dc=5&dv=1&dl=387&retryCode=socketNotConnected	false		unknown
https://collection.decibelinsight.net/i/14028/da/?type=multi&wid=693653&sid=84E654F18AD2AE89A616AA13A6B4CC6A8F&jspsf=1&pvid=1730380361972&dc=2&dv=1&dl=954&retryCode=socketNotConnected	false		unknown

Name	Source	Malicious	Antivirus Detection	Reputation
http://rsxdeployment.azurewebsites.net/)	chromecache_238.2.dr, chromecache_305.2.dr	false		unknown
https://stats.g.doubleclick.net/g/collect	chromecache_315.2.dr, chromecache_436.2.dr, chromecache_479.2.dr, chromecache_468.2.dr	false	URL Reputation: safe	unknown
https://developers.google.com/recaptcha/docs/faq#localhost_support	chromecache_330.2.dr, chromecache_373.2.dr, chromecache_271.2.dr	false	URL Reputation: safe	unknown
https://www.youtube.com/embed/	chromecache_503.2.dr	false		unknown
https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement.js	chromecache_527.2.dr, chromecache_377.2.dr	false		unknown
https://www.medallia.com/	chromecache_297.2.dr, chromecache_528.2.dr	false		unknown
https://www.youtube.com	chromecache_325.2.dr	false		unknown
https://www.bell.ca/?lang=en	chromecache_552.2.dr	false		unknown
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_311.2.dr, chromecache_314.2.dr, chromecache_406.2.dr, chromecache_504.2.dr	false		unknown
https://support.google.com/recaptcha/#6175971	chromecache_330.2.dr, chromecache_373.2.dr, chromecache_271.2.dr	false	URL Reputation: safe	unknown
http://getbootstrap.com)	chromecache_466.2.dr	false		unknown
http://rsxdeployment.azurewebsites.net/docs/components.html#buttons	chromecache_466.2.dr	false		unknown
https://github.com/microsoft/clarity	chromecache_364.2.dr	false		unknown
https://support.google.com/recaptcha	chromecache_271.2.dr	false	URL Reputation: safe	unknown
https://www.gstatic.c..?/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/recaptcha__.	chromecache_330.2.dr, chromecache_373.2.dr, chromecache_271.2.dr	false		unknown
https://assets.adobedtm.com/92c238f848e3/7634fe33bd4f/09957f73d351/RCa4958c9bb22a442ba8003fb2e6085ec	chromecache_374.2.dr	false		unknown
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que	chromecache_330.2.dr, chromecache_373.2.dr, chromecache_271.2.dr	false	URL Reputation: safe	unknown
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_311.2.dr, chromecache_466.2.dr, chromecache_314.2.dr, chromecache_255.2.dr, chromecache_406.2.dr, chromecache_504.2.dr	false		unknown
https://www.google.com/pagead/1p-user-list/953414520/?random	chromecache_448.2.dr, chromecache_556.2.dr, chromecache_529.2.dr, chromecache_247.2.dr, chromecache_237.2.dr	false		unknown
https://assets.adobedtm.com/92c238f848e3/7634fe33bd4f/09957f73d351/RC0999b7fb83bc47cc8ef3706d46ca0c8	chromecache_319.2.dr	false		unknown
https://assets.adobedtm.com/92c238f848e3/7634fe33bd4f/09957f73d351/RCfaa9cdadad144c4c921b649cd3b6204	chromecache_306.2.dr	false		unknown
http://rsxdeployment.azurewebsites.net/docs/components.html#tags	chromecache_466.2.dr	false		unknown
https://jqueryui.com/slider/)	chromecache_466.2.dr	false		unknown
https://www.clarity.ms/tag/uet/	chromecache_493.2.dr, chromecache_386.2.dr	false	URL Reputation: safe	unknown
http://rsxdeployment.azurewebsites.net/docs/widgets.html#widgets-color-selector	chromecache_466.2.dr	false		unknown
http://rsxdeployment.azurewebsites.net/docs/icons.html	chromecache_466.2.dr	false		unknown
https://www.dynatrace.com/company/trust-center/customers/reports/	chromecache_366.2.dr, chromecache_249.2.dr, chromecache_341.2.dr	false		unknown
https://developers.google.com/youtube/iframe_api_reference#Events	chromecache_403.2.dr, chromecache_325.2.dr	false	URL Reputation: safe	unknown
https://cloud.google.com/contact	chromecache_330.2.dr, chromecache_373.2.dr, chromecache_271.2.dr	false	URL Reputation: safe	unknown
https://assets.adobedtm.com/92c238f848e3/0fc93359920c/launch-26891e3701a2.min.js	chromecache_552.2.dr	false		unknown
https://www.bell.ca/Forfaits	chromecache_355.2.dr, chromecache_412.2.dr	false		unknown
https://assets.adobedtm.com/92c238f848e3/7634fe33bd4f/09957f73d351/RCb7424d10cb45420b8dd270fd16b2f20	chromecache_467.2.dr	false		unknown
https://assets.adobedtm.com/92c238f848e3/7634fe33bd4f/09957f73d351/RCd18a66557b034fc5825d670005205c3	chromecache_543.2.dr	false		unknown
https://www.google.com/recaptcha/api2/	chromecache_330.2.dr, chromecache_373.2.dr, chromecache_271.2.dr	false		unknown
https://assets.adobedtm.com/92c238f848e3/7634fe33bd4f/09957f73d351/RC70933dcf655e4484bbad15d268bdebf	chromecache_497.2.dr	false		unknown
http://kenwheeler.github.io/slick	chromecache_406.2.dr, chromecache_504.2.dr	false	URL Reputation: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.228	unknown	United States	15169	GOOGLEUS	false
52.214.60.57	unknown	United States	16509	AMAZON-02US	false
147.75.178.60	digital.lb.can.medallia.ca	Switzerland	30109	MEDALLIA-INCUS	false
66.235.152.225	adobetarget.data.adobedc.net	United States	15224	OMNITUREUS	false
108.156.60.64	api2.branch.io	United States	16509	AMAZON-02US	false
206.47.98.207	mybell-on-priority.gdns.bell.ca	Canada	577	BACOMCA	false
66.235.152.221	unknown	United States	15224	OMNITUREUS	false
3.162.38.87	unknown	United States	16509	AMAZON-02US	false
52.50.97.18	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
18.184.216.10	ps.eyeota.net	United States	16509	AMAZON-02US	false
130.61.120.2	collection.decibelinsight.net	United States	31898	ORACLE-BMC-31898US	false
34.250.133.195	unknown	United States	16509	AMAZON-02US	false
34.117.77.79	ml314.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
162.159.140.229	unknown	United States	13335	CLOUDFLARENETUS	false
63.32.87.126	unknown	United States	16509	AMAZON-02US	false
104.244.42.131	unknown	United States	13414	TWITTERUS	false
63.140.62.17	bell.ca.ssl.sc.omtrdc.net	United States	15224	OMNITUREUS	false
142.250.185.238	unknown	United States	15169	GOOGLEUS	false
108.138.26.118	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	unknown	European Union	13335	CLOUDFLARENETUS	false
150.171.29.10	ax-0001.ax-dc-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
199.232.188.157	platform.twitter.map.fastly.net	United States	54113	FASTLYUS	false
143.204.207.250	sc-static.net	United States	16509	AMAZON-02US	false
52.223.40.198	match.adsrvr.org	United States	8987	AMAZONEXPANSIONGB	false
172.217.18.100	unknown	United States	15169	GOOGLEUS	false
18.239.50.55	unknown	United States	16509	AMAZON-02US	false
98.82.156.107	s.amazon-adsystem.com	United States	11351	TWC-11351-NORTHEASTUS	false
18.239.18.118	app.link	United States	16509	AMAZON-02US	false
64.233.167.157	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
52.9.108.223	custom.bnc.lt	United States	16509	AMAZON-02US	false
142.250.186.174	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
18.239.18.88	bell.app.link	United States	16509	AMAZON-02US	false
216.58.206.36	www.google.com	United States	15169	GOOGLEUS	false
63.140.62.27	unknown	United States	15224	OMNITUREUS	false
157.240.0.6	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
87.248.119.251	unknown	United Kingdom	203220	YAHOO-DEBDE	false
87.248.119.252	dcs-ups.g03.yahoodns.net	United Kingdom	203220	YAHOO-DEBDE	false
98.82.157.231	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
142.250.185.164	unknown	United States	15169	GOOGLEUS	false
146.75.117.230	medallia2.map.fastly.net	Sweden	30051	SCCGOVUS	false
150.171.28.10	ax-0001.ax-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.98	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
13.107.253.45	s-part-0017.t-0009.fb-t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.244.42.3	s.twitter.com	United States	13414	TWITTERUS	false
18.66.27.34	cdn.branch.io	United States	3	MIT-GATEWAYSUS	false
18.65.39.29	d1tcwf12y4kqv3.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
35.241.45.82	cooladata.kampyle.com	United States	15169	GOOGLEUS	false
142.250.185.130	cm.g.doubleclick.net	United States	15169	GOOGLEUS	false
142.250.185.174	analytics.google.com	United States	15169	GOOGLEUS	false
54.194.72.83	sync.crwdcntrl.net	United States	16509	AMAZON-02US	false
188.114.96.3	siteimproveanalytics.com	European Union	13335	CLOUDFLARENETUS	false
172.66.0.227	t.co	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546108
Start date and time:	2024-10-31 14:10:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://mybell.bell.ca/Login?language=en
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@37/480@197/54
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Source	URL
Screenshot	https://m.bell.ca/getapploginpage
Screenshot	https://m.bell.ca/supportrqcode

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 12:11:52 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.971528685719368
Encrypted:	false
SSDEEP:	48:8Xvd1TkjHyidAKZdA1P4ehwiZUklqehJy+3:8LwMOCy
MD5:	7E559CED085A2978C00516C6283F1D7D
SHA1:	3BB6B115322E6A4531A488AD65DEA1C8EB7F885D
SHA-256:	93DA0B5F77899683A4CA3DB82D6BCA5A1AD7EB9C0BB5E4ADB7EB5F8B083322D2
SHA-512:	483197018960C46BEB835CB1555CB8D539442A0276D23F795FB23626102A9A4C127C7FE14BD70EDCE7FF5364C83B04C2F0C01E7AD7E3C22F59FC5092AE0E6E45
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......s.+....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I_Yyi....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V_Yyi....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V_Yyi....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V_Yyi.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V_Yzi...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............a.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:11:43 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 13:11:44 UTC	540	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 13:11:43 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 28 Oct 2024 13:23:36 GMT ETag: "0x8DCF753BAA1B278" x-ms-request-id: acfedf75-801e-002a-2768-2931dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T131143Z-17c5cb586f67hfgj2durhqcxk800000008cg00000000f5rd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 13:11:44 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-31 13:11:44 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-31 13:11:44 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-31 13:11:44 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-31 13:11:44 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-31 13:11:44 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-31 13:11:44 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-31 13:11:44 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-31 13:11:44 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-31 13:11:45 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://mybell.bell.ca/Login?language=en

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

QR Codes

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 234

Chrome Cache Entry: 235

Chrome Cache Entry: 236

Chrome Cache Entry: 237

Chrome Cache Entry: 238

Chrome Cache Entry: 239

Chrome Cache Entry: 240

Chrome Cache Entry: 241

Chrome Cache Entry: 242

Chrome Cache Entry: 243

Chrome Cache Entry: 244

Chrome Cache Entry: 245

Chrome Cache Entry: 246

Chrome Cache Entry: 247

Chrome Cache Entry: 248

Chrome Cache Entry: 249

Chrome Cache Entry: 250

Chrome Cache Entry: 251

Chrome Cache Entry: 252

Windows Analysis Report
https://mybell.bell.ca/Login?language=en

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:11:50 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 13:11:50 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 13:11:50 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 041e76a7-601e-005c-45ae-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T131150Z-16849878b78x6gn56mgecg60qc0000000bc000000000bt27 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 13:11:50 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:11:50 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 13:11:50 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 13:11:50 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 11ae3112-301e-005d-596b-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T131150Z-16849878b78j5kdg3dndgqw0vg0000000bcg0000000007tw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 13:11:50 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:11:50 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 13:11:50 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 13:11:50 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T131150Z-16849878b78fssff8btnns3b1400000009t000000000f017 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 13:11:50 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:11:50 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 13:11:50 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 13:11:50 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 67a0dec0-201e-006e-29f9-2abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T131150Z-15b8d89586fst84kttks1s2css000000035g00000000bnr7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 13:11:50 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:11:50 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 13:11:50 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 13:11:50 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: fc6998d3-101e-008d-52ad-2692e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T131150Z-16849878b787bfsh7zgp804my400000008bg00000000bb7r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 13:11:50 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:11:51 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 13:11:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 13:11:51 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 7b93b929-d01e-0082-6676-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T131151Z-16849878b78qwx7pmw9x5fub1c00000007s00000000083a1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 13:11:51 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:11:51 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 13:11:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 13:11:51 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 045b826b-001e-0014-04b7-2a5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T131151Z-159b85dff8fprglthC1DFW8zcg00000001eg000000003mvu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 13:11:51 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:11:51 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 13:11:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 13:11:51 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 4755be7f-e01e-0052-062b-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T131151Z-16849878b786lft2mu9uftf3y40000000aqg00000000mw3a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 13:11:51 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:11:51 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 13:11:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 13:11:51 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 0d0c59f1-101e-005a-526a-27882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T131151Z-17c5cb586f64sw5wh0dfzbdtvw00000001vg000000000ns9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 13:11:51 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:11:51 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 13:11:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 13:11:51 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 8abc48b9-201e-0096-2f4f-28ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T131151Z-15b8d89586fhl2qtatrz3vfkf00000000g1g0000000004e0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 13:11:51 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]